Subject: [PATCH v2 0/6] trace2: add macOS and Windows process ancestry tracing

From: "Matthew John Cheetham via GitGitGadget" <[email-masked]>
Date: Fri, 13 Feb 2026 19:54:54 +0000

In 353d3d77f4 (trace2: collect Windows-specific process information,
2019-02-22) Windows-specific process ancestry information was added as a
data_json event to TRACE2. Furthermore in 2f732bf15e (tr2: log parent
process name, 2021-07-21) similar functionality was added for Linux-based
systems, using procfs.

Let's teach Git on macOS to also gather process ancestry information, and
emit it as a cmd_ancestry TRACE2 event.

Furthermore, let's refactor the Windows implementation to align with the
Linux and macOS versions - by emitting the ancestry information as a
cmd_ancestry event. We keep the older, custom data_json event type on
Windows for compatibility for consumers of the TRACE2 data that use the
older event.

Finally, we add tests of the cmd_ancestry events in the new t0213 test
script. Extend the trace2 test helper to allow us to execute commands with a
known process in the ancestry ("test-tool"); we use this to allow tests to
filter out the uncontrolled environment (how the test script was run, and on
what system).

Thanks, Matthew

Updates in v2
=============

 * On macOS do not filter out PPID 1 or 0, to match what the Linux
   implementation does.
   
   Stopping before PID 1 and 0 means we do not emit the launchd init process
   on macOS. The Linux implementation does not do this, nor does the Windows
   implementation.

 * Add t0213-trace2-ancestry tests and extend the trace2 test helper.
   
   The tests use the "400ancestry" test helper to spawn child processes with
   controlled trace2 environments. Verify that the process ancestry is being
   correctly captured on platforms that support cmd_ancestry.

 * Drop USE_THE_REPOSITORY_VARIABLE macro as it was not required.

 * Updated commit messages to use more standard format to refer to existing
   commits.

Matthew John Cheetham (6):
  trace2: add macOS process ancestry tracing
  build: include procinfo.c impl for macOS
  trace2: refactor Windows process ancestry trace2 event
  trace2: emit cmd_ancestry data for Windows
  test-tool: extend trace2 helper with 400ancestry
  t0213: add trace2 cmd_ancestry tests

 compat/darwin/procinfo.c                 |  97 ++++++++++++
 compat/win32/trace2_win32_process_info.c |  58 ++++----
 config.mak.uname                         |   2 +
 contrib/buildsystems/CMakeLists.txt      |   2 +
 meson.build                              |   2 +
 t/helper/test-trace2.c                   |  59 ++++++++
 t/meson.build                            |   1 +
 t/t0210-trace2-normal.sh                 |   5 +-
 t/t0213-trace2-ancestry.sh               | 180 +++++++++++++++++++++++
 9 files changed, 379 insertions(+), 27 deletions(-)
 create mode 100644 compat/darwin/procinfo.c
 create mode 100755 t/t0213-trace2-ancestry.sh

base-commit: 9a2fb147f2c61d0cab52c883e7e26f5b7948e3ed
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2040%2Fmjcheetham%2Ftrace2-macos-ancestry-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2040/mjcheetham/trace2-macos-ancestry-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/2040

Range-diff vs v1:

 1:  d99a30a1a7 ! 1:  233f6cdd33 trace2: add macOS process ancestry tracing
     @@ Metadata
       ## Commit message ##
          trace2: add macOS process ancestry tracing
      
     -    In 353d3d77 (trace2: collect Windows-specific process information)
     -    Windows-specific process ancestry information was added as a data_json
     -    event to TRACE2. Furthermore in 2f732bf1 (tr2: log parent process name)
     -    similar functionality was added for Linux-based systems, using procfs.
     +    In 353d3d77f4 (trace2: collect Windows-specific process information,
     +    2019-02-22) Windows-specific process ancestry information was added as
     +    a data_json event to TRACE2. Furthermore in 2f732bf15e (tr2: log
     +    parent process name, 2021-07-21) similar functionality was added for
     +    Linux-based systems, using procfs.
      
          Teach Git to also log process ancestry on macOS using the sysctl with
          KERN_PROC to get process information (PPID and process name).
     @@ Commit message
      
       ## compat/darwin/procinfo.c (new) ##
      @@
     -+#define USE_THE_REPOSITORY_VARIABLE
     -+
      +#include "git-compat-util.h"
      +#include "strbuf.h"
      +#include "strvec.h"
     @@ compat/darwin/procinfo.c (new)
      +	strvec_push(names, name.buf);
      +
      +	/*
     -+	 * Recurse to the parent process. Stop if ppid is 0 or 1
     -+	 * (init/launchd) or if we've reached ourselves (cycle).
     ++	 * Recurse to the parent process. Stop if ppid not valid
     ++	 * or if we've reached ourselves (cycle).
      +	 */
     -+	if (ppid > 1 && ppid != pid)
     ++	if (ppid && ppid != pid)
      +		push_ancestry_name(names, ppid, depth + 1);
      +
      +cleanup:
 2:  c786a038f3 = 2:  546fcc3446 build: include procinfo.c impl for macOS
 3:  7ccd0a9a6d ! 3:  2b02f62f0d trace2: refactor Windows process ancestry trace2 event
     @@ Metadata
       ## Commit message ##
          trace2: refactor Windows process ancestry trace2 event
      
     -    In 353d3d77 (trace2: collect Windows-specific process information) we
     -    added process ancestry information for Windows to TRACE2 via a data_json
     -    event. It was only later in 2f732bf1 (tr2: log parent process name) that
     -    the specific cmd_ancestry event was added to TRACE2.
     +    In 353d3d77f4 (trace2: collect Windows-specific process information,
     +    2019-02-22) we added process ancestry information for Windows to TRACE2
     +    via a data_json event. It was only later in 2f732bf15e (tr2: log parent
     +    process name, 2021-07-21) that the specific cmd_ancestry event was
     +    added to TRACE2.
      
          In a future commit we will emit the ancestry information with the newer
          cmd_ancestry TRACE2 event. Right now, we rework this implementation of
 4:  a06344dc75 ! 4:  6b9054115e trace2: emit cmd_ancestry data for Windows
     @@ Metadata
       ## Commit message ##
          trace2: emit cmd_ancestry data for Windows
      
     -    Since 2f732bf1 (tr2: log parent process name) it is now possible to emit
     -    a specific process ancestry event in TRACE2. We should emit the Windows
     -    process ancestry data with the correct event type.
     +    Since 2f732bf15e (tr2: log parent process name, 2021-07-21) it is now
     +    now possible to emit a specific process ancestry event in TRACE2. We
     +    should emit the Windows process ancestry data with the correct event
     +    type.
      
          To not break existing consumers of the data_json "windows/ancestry"
          event, we continue to emit the ancestry data as a JSON event.
 -:  ---------- > 5:  b9a94291a6 test-tool: extend trace2 helper with 400ancestry
 -:  ---------- > 6:  6a5232540e t0213: add trace2 cmd_ancestry tests

-- 
gitgitgadget